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REMARKS 
Claims 1, 10 and 15 are Allowable 

The Office has rejected claims 1,10 and 1 5, at paragraphs 4 and 5 of the Office Action, 
under 35 U.S.C. §l02(e), as being anticipated by U.S. Patent No. 6,647,400 ("Mc-ran"). 
Applicants respectfully traverse the rejections. 

None of the cited references, including Moran, disclose or suggest the specific 
combination of claim 1 , For example, Moran does not disclose upon identifying a mismatch in 
compared digital signatures, issuing an instruction to record an entry in a log file located in a 

« 

second remote database, said entry identifying a possible intrusion in a host, as recited in claim 
1. Rather, Moran discloses that if there is a mismatch of signatures, an analysis engine checks if 
the mismatch is expected and if not, the file is flagged as suspicious. See Moran, col. 32, lines 
56-58. Hence, claim 1 is allowable- 
Further, none of the cited references, including Moran, disclose or suggest the specific 
combination of claim 10. For example, Moran does not disclose a log "database remote from the 
host recording entries corresponding to mismatches between a digital signature stored in the host 
and a corresponding digital signature in the digital signature database, as recited in claim 10. 
Instead, Moran discloses that if a mismatch of signatures is discovered and if the mismatch is not 
expected, the file is flagged as suspicious. See Moran, coL 32, lines 56-58. Therefore, claim 10 
is allowable. 

In addition, none of the cited references, including Moran, disclose or suggest the specific 
combination of claim 15. For example, Moran does not disclose computer readable program 
code including executable instructions to issue an instruction to record an entry in a log file 
located in a second remote database upon identifying a mismatch in compared digital signatures, 
said entry identifying a possible intrusion in a host, as recited in claim 15. Instead, Moran 
discloses that if a mismatch of signatures is discovered and if the mismatch is not expected, the 
file is flagged as suspicious. See Moran, col. 32, lines 56-58. Therefore, claim 15 is allowable. 
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Claims 2-9, 11-14, and 16-24 are Allowable 

The Office has rejected claims 2-9, 11-14, and 16-24, at paragraphs 6 and 7 of the Office 
Action, under 35 ILS.C. §103(a), as being unpatentable over Moran in view of by U.S. Patent 
No. 5,9 1 9,25 7 ("Trostle") . Applicants respectfully traverse the rej ections. 

As explained previously, Moran does not disclose all elements of claim 1. Trostle does 
not disclose or suggest the elements of claim 1 not disclosed by Moran. For example, Tiostle 
does not disclose upon identifying a mismatch in compared digital signatures, issuing an 
instruction to record an entry in a log file located in a second remote database, said entry 
identifying a possible intrusion in a host, as recited in claim 1, Rather, Trostle discloses that 
during pre-boot, a networked workstation performs an intrusion detection hashing function on 
selected executable programs, and a computed hash value is compared against a trusted hash 
value downloaded from a server, in order to detect unauthorized changes to the selected 
workstation executable programs. If illicit changes are detected, the user or network system 
administrator is notified in order to take corrective action. See Trostle, Abstract, and coL 2, line 
61 - col. 3, line 2. Claims 2-9 depend from claim 1. Therefore, claims 2-9 are allowable, at least 
by virtue of their dependence from claim I . 

Further, neither Moran, nor Trostle, disclose or suggest a method issuing a command to 
an operating system of a host to bring the host to a single user state upon identifying the 
mismatch in compared digital signatures, as recited in claim 3. Instead, Trostle discloses locking 
a user out when a maximum number of allowable unsuccessful logins has been exceeded by 
disabling the workstation. See Trostle, Fig. 5, step 100, and col 6, lines 30-42. Further, Moran 
does not disclose these elements of claims 2 and 3, See Office Action, paragraph 7. For this 
additional reason, claim 3 is allowable. 

Further, neither Moran, nor Trostle, disclose or suggest first and second remote databases 
located on a single server, or a plurality of servers belonging to a local area network, the first 
remote database storing a digital signature and the second remote database in which an entry is 
recorded identifying a possible intrusion in the host, as recited in claim 4. In contrast to claim 4, 
Trostle discloses a network client server computing system including a server that stores a 
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database of trusted hash values, user objects, workstation objects, and pre-boot software 
modules. See Trostle, col. 3, lines 53-55, Fig. 1. Trostle does not disclose a second remote 
database to record an entry identifying a possible intrusion in the host For this additional 
reason, claim 4 is allowable. 

As explained previously, Moran does not disclose all of the elements of claim 10. Trostle 
does not disclose or suggest the elements of claim 1 0 not disclosed by Moran. For example, 
Trostle does not disclose a log database remote from the host recording entries corresponding to 
mismatches between a digital signature stored in the host and a corresponding digital signature in 
the digital signature database, as recited in claim 10. Rather, Trostle discloses notifying a user or 
network system administrator to take corrective action if illicit changes in selected workstation 
executable programs are detected through comparison of computed hash values of executable 
programs with trusted hash values downloaded from a server. See Trostle, Abstract, and coL 2, 
line 61 - col. 3, line 2. Claims 1 1-14 depend from claim 10, Therefore, claims 1 1-14 are 
allowable, at least by virtue of their dependence from claim 10. 

As explained previously, Moran does not disclose all elements of claim 15. Trostle does 
not disclose or suggest the elements of claim 15 not disclosed by Moran. For example, Trostle 
does not disclose or suggest compute* readable program code comprising executable instructions 
to issue an instruction to record an entry in a log file located in a second remote database upon 
identifying a mismatch in compared digital signatures, as recited in claim 1 5. Rather, Trostle 
discloses notifying a user or network system administrator to take corrective action if illicit 
changes in selected workstation executable programs are detected through comparison of 
computed hash values of executable programs with trusted hash values downloaded from a 
server. See Trostle, Abstract, and coL 2, line 61 - col. 3, line 2. Claims 16-17 depend from 
claim 15. Therefore, claims 16 and 17 are allowable, at least by virtue of their dependence from 
claim 15. 

Further, neither Moran, nor Trostle, disclose or suggest computer readable program code 
comprising executable instructions to issue a command to an operating system of said host to 
bring said host to a single user state upon identifying the mismatch in compared digital 
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signatures, as recited in claim 17. In contrast to claim 17, Trestle discloses locking a user out 
when a maximum number of allowable unsuccessful logins has been exceeded by disabling the 
workstation* See Trostle, Fig. 5, step 100, and col. 6, lines 30-42. As explained with regard to 
claim 3, Moran does not disclose this element of claim 17- See Office Action, p. 5, paragraph 7. 
For this additional reason, claim 17 is allowable. 



None of the references, including Moran and Trostle, disclose or suggest the specific 
combination of claim 1 8. For example, Moran does not disclose upon identifying a mismatch, 
transmitting an instruction to a remote log database via said one or more network interfaces, said 
instruction executed in said remote log database to record an entry in a log file indicating a 
possible intrusion in said host, as recited in claim 1 8. In contrast to claim 1 8, Moran discloses 
that if there is a mismatch of signatures, an analysis engine checks if the mismatch is expected 
and if not, the file is flagged as suspicious. See Moran, col. 32, lines 56-58. Further, Trostle 
does not disclose this element of claim 18. Instead, Trostle discloses comparing a computed 
hash value of an executable program to a trusted hash value to detect illicit changes in the 
executable program, and notifying the user or system administrator if changes are detected. See 
Trostle, col 2, line 45 - col. 3, line 2. Accordingly, claim 1 8 is allowable. 

Claims 19-24 depend from claim 18, which Applicants have shown to be allowable. 
Therefore, Moran and Trostle do not disclose at least one element of each of claims 19-24. 

■ 

Accordingly, claims 19-24 are allowable, at least by virtue of their dependence from claim 18, 

CONCLUSION 

Applicants have pointed out specific features of the claims not disclosed, suggested, or 
rendered obvious by the references applied in the Office Action. Accordingly, Applicants 
respectfully request reconsideration and withdrawal of each of the objections and rejections, as 
well as an indication of the allowability of each of the pending claims. 

Any changes to the claims in this amendment, which have not been specifically noted to 
overcome a rejection based upon the prior art, should be considered to have been made for a 
purpose unrelated to patentability, and no estoppel should be deemed to attach thereto. 
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The Examiner is invited to contact the undersigned attorney at the telephone number 
listed below if such a call would in any way facilitate allowance of this application. 

The Commissioner is hereby authorized to charge any fees, which may be requited, or 
credit any overpayment, to Deposit Account Number 50-2469. 



Respectfully submitted, 




£l Jeffiey'G. Toler, Reg. No. 38,342 

Date Attorney for Applicants 

TOLER SCHAFFER, LX.P. 
8500 Bluffstone Cove, Suite A201 
Austin, Texas 78759 
(512) 327-5515 (phone) 
(512)327-5575 (fax) 
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